apache/airflow · Security
Apache Airflow Cross-site Scripting Vulnerability
- GHSA ID
- GHSA-65xw-pcqw-hjrh
- CVE ID
- CVE-2021-45229
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v4
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Description
It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument. This issue affects Apache Airflow versions 2.2.3 and below.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-45229 ↗
- https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk ↗
- https://github.com/apache/airflow/commit/628aa1f99c865d97d0b1c7c76e630e43a7b8d319 ↗
- https://github.com/advisories/GHSA-65xw-pcqw-hjrh ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-29.yaml ↗